Privilege hygiene is the practice of keeping access rights tightly limited, regularly reviewed, and matched to each user’s current job needs. It follows the principle of least privilege: people, services, and administrators should have only the permissions they actually require, for only as long as they need them.
It matters because excessive or stale privileges make intrusions much harder to contain. If an attacker steals a valid account or compromises one machine, weak privilege hygiene can let that foothold turn into wider access, data theft, or persistence. In long-dwell incidents, defenders often look for overbroad admin rights, shared accounts, dormant accounts, and forgotten service permissions. Good hygiene includes role-based access control, periodic access reviews, rapid revocation when roles change, MFA for sensitive actions, and separate admin accounts. Strong privilege hygiene does not stop every breach, but it reduces how far an intruder can move and makes suspicious activity easier to spot.